Decode SAN IP address field from CSR

4 files changed, 28 insertions, 5 deletions

diff --git a/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/Certificates.java b/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/Certificates.java
index 447b6efb09b..a4cf54063ec 100644
--- a/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/Certificates.java
+++ b/athenz-identity-provider-service/src/main/java/com/yahoo/vespa/hosted/ca/Certificates.java
@@ -43,7 +43,7 @@ public class Certificates {
                                               SHA256_WITH_ECDSA,
                                               X509CertificateBuilder.generateRandomSerialNumber());
         for (var san : csr.getSubjectAlternativeNames()) {
-            builder = builder.addSubjectAlternativeName(san.getValue());
+            builder = builder.addSubjectAlternativeName(san.decode());
         }
         return builder.build();
     }
diff --git a/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificateTester.java b/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificateTester.java
index 4946de93f6d..130a4ec5e66 100644
--- a/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificateTester.java
+++ b/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificateTester.java
@@ -47,13 +47,16 @@ public class CertificateTester {
         return createCsr(null);
     }
 
-    public static Pkcs10Csr createCsr(String dnsName) {
+    public static Pkcs10Csr createCsr(String dnsName, String... ipAddresses) {
         X500Principal subject = new X500Principal("CN=subject");
         KeyPair keyPair = KeyUtils.generateKeypair(KeyAlgorithm.EC, 256);
         var builder = Pkcs10CsrBuilder.fromKeypair(subject, keyPair, SignatureAlgorithm.SHA512_WITH_ECDSA);
         if (dnsName != null) {
             builder = builder.addSubjectAlternativeName(SubjectAlternativeName.Type.DNS_NAME, dnsName);
         }
+        for (var ipAddress : ipAddresses) {
+            builder = builder.addSubjectAlternativeName(SubjectAlternativeName.Type.IP_ADDRESS, ipAddress);
+        }
         return builder.build();
     }
 
diff --git a/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificatesTest.java b/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificatesTest.java
index 80940dcd02c..fa86979656d 100644
--- a/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificatesTest.java
+++ b/athenz-identity-provider-service/src/test/java/com/yahoo/vespa/hosted/ca/CertificatesTest.java
@@ -40,13 +40,18 @@ public class CertificatesTest {
     public void add_san_from_csr() throws Exception {
         var certificates = new Certificates(new ManualClock());
         var dnsName = "host.example.com";
-        var csr = CertificateTester.createCsr(dnsName);
+        var ip = "192.0.2.42";
+        var csr = CertificateTester.createCsr(dnsName, ip);
         var certificate = certificates.create(csr, caCertificate, keyPair.getPrivate());
 
         assertNotNull(certificate.getSubjectAlternativeNames());
-        assertEquals(1, certificate.getSubjectAlternativeNames().size());
+        assertEquals(2, certificate.getSubjectAlternativeNames().size());
+
+        var subjectAlternativeNames = List.copyOf(certificate.getSubjectAlternativeNames());
         assertEquals(List.of(SubjectAlternativeName.Type.DNS_NAME.getTag(), dnsName),
-                     certificate.getSubjectAlternativeNames().iterator().next());
+                     subjectAlternativeNames.get(0));
+        assertEquals(List.of(SubjectAlternativeName.Type.IP_ADDRESS.getTag(), ip),
+                     subjectAlternativeNames.get(1));
     }
 
 }
diff --git a/security-utils/src/main/java/com/yahoo/security/SubjectAlternativeName.java b/security-utils/src/main/java/com/yahoo/security/SubjectAlternativeName.java
index 29395c75e70..81581c8146c 100644
--- a/security-utils/src/main/java/com/yahoo/security/SubjectAlternativeName.java
+++ b/security-utils/src/main/java/com/yahoo/security/SubjectAlternativeName.java
@@ -3,10 +3,13 @@ package com.yahoo.security;
 
 import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.DERIA5String;
+import org.bouncycastle.asn1.DEROctetString;
 import org.bouncycastle.asn1.x500.X500Name;
 import org.bouncycastle.asn1.x509.GeneralName;
 import org.bouncycastle.asn1.x509.GeneralNames;
 
+import java.net.InetAddress;
+import java.net.UnknownHostException;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Objects;
@@ -43,6 +46,10 @@ public class SubjectAlternativeName {
         return new GeneralName(type.tag, value);
     }
 
+    public SubjectAlternativeName decode() {
+        return new SubjectAlternativeName(new GeneralName(type.tag, value));
+    }
+
     static List<SubjectAlternativeName> fromGeneralNames(GeneralNames generalNames) {
         return Arrays.stream(generalNames.getNames()).map(SubjectAlternativeName::new).collect(toList());
     }
@@ -56,6 +63,14 @@ public class SubjectAlternativeName {
                 return DERIA5String.getInstance(name).getString();
             case GeneralName.directoryName:
                 return X500Name.getInstance(name).toString();
+            case GeneralName.iPAddress:
+                var octets = DEROctetString.getInstance(name.toASN1Primitive()).getOctets();
+                try {
+                    return InetAddress.getByAddress(octets).getHostAddress();
+                } catch (UnknownHostException e) {
+                    // Only thrown if IP address is of invalid length, which is an illegal argument
+                    throw new IllegalArgumentException(e);
+                }
             default:
                 return name.toString();
         }